Threats affecting pkg:github/ethyca/fides

A DOM-based cross-site scripting (XSS) vulnerability exists in ethyca fides versions from 2.33.0 up to but not including 2.84.5. The issue arises via the fides_description override in fides.js. This vulnerability allows improper neutralization of input during web page generation. The vulnerability has been patched in version 2.84.5.

CVE-2026-42303 is an authentication bypass vulnerability in ethyca's open-source privacy engineering platform, Fides, affecting versions from 2.75.0 up to but not including 2.83.2. When both subject identity verification and duplicate privacy request detection are enabled, an administrator can approve a privacy request without the subject's identity being verified. This flaw can lead to unauthorized erasure of a data subject's records across all integrations configured in the affected deployment. The vulnerability is fixed in version 2.83.2.